JsonAuthenticator.php

<?php

namespace App\Authentication\Authenticator;

use Authentication\Authenticator\FormAuthenticator;
use Psr\Http\Message\ServerRequestInterface;

/**
 * Class ApiAuthenticator
 * @package App\Authentication\Authenticator
 */
class JsonAuthenticator extends FormAuthenticator
{
    protected function _getData(ServerRequestInterface $request)
    {
        $fields = $this->_config['fields'];
        $body = json_decode($request->getBody()->getContents(), true);

        $data = [];
        foreach ($fields as $key => $field) {
            if (!isset($body[$field])) {
                return null;
            }

            $value = $body[$field];
            if (!is_string($value) || !strlen($value)) {
                return null;
            }

            $data[$key] = $value;
        }

        return $data;
    }
}

This bit is no longer needed since CakePHP itself has a BodyParserMiddleware that addresses this.
cakephp/authentication#185
cakephp/cakephp#11875